Overview

overview

7

Static

static

3

Zenium.exe

windows10-2004-x64

7

Zenium.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    15/04/2026, 06:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Zenium.exe
  • Size 8.6MB
  • Sample260415-hhsetsbt91
  • SHA256 419439a907d3e0d2e75380a65831194208dd575ab0fb23abab95f49cd3f1be6f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 22 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Zenium.exe
    "C:\Users\Admin\AppData\Local\Temp\Zenium.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1456
    • C:\Users\Admin\AppData\Local\Temp\Zenium.exe
      C:\Users\Admin\AppData\Local\Temp\Zenium.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3892
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ".;)163)."
        3⤵
          PID:2312
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "-739z*(59?))z=?.z9;*.354"
          3⤵
            PID:4756
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\python.exe -m pip install --quiet --upgrade *#-34ih"
            3⤵
              PID:4832
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\python.exe -m pip install --quiet --upgrade *#9(#*.5>57?\""
              3⤵
                PID:3492
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\python.exe -m pip install --quiet --upgrade (?+/?).)"
                3⤵
                  PID:2192
                • C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe
                  C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\python.EXE C:\Users\Admin\AppData\Local\Temp\Zenium.exe
                  3⤵
                    PID:4652

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    81d243bd2c585b0f4821__mypyc.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\81d243bd2c585b0f4821__mypyc.pyd
                    • Size 194KB
                    • SHA256 b5e9233a4a54059301daa4e703b9de97b7dc6b9d1ab5778f58285e5fc214af5e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _ctypes.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd
                    • Size 129KB
                    • SHA256 5c4c489ac052795c27af063c96bc4db5ab250144d4839050cfa9bb3836b87c32
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _lzma.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_lzma.pyd
                    • Size 155KB
                    • SHA256 e44dea262a24df69fd9b50b08d09ae6f8b051137ce0834640c977091a6f9fca8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _sqlite3.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_sqlite3.pyd
                    • Size 126KB
                    • SHA256 c2161b71db9ce8c518d65e8a36c9ec67cd6d039ff732203b8adbe2c7ea883f6d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _ssl.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ssl.pyd
                    • Size 178KB
                    • SHA256 e94f0195363c5c9babfc4c17ec6fb1aa8bbabf59e377db66ce6a79c4c58bbd07
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    md.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\charset_normalizer\md.pyd
                    • Size 10KB
                    • SHA256 a766c3b2f45520d1fa295b5c20cb827593769fa41e550926c3ddbec8f9d8f8f7
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    libcrypto-3.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libcrypto-3.dll
                    • Size 5.0MB
                    • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    libssl-3.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libssl-3.dll
                    • Size 774KB
                    • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sqlite3.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\sqlite3.dll
                    • Size 1.5MB
                    • SHA256 afb50a080d3c79d9c89d134b006fb2b0779b5ffeeb703762d163141b15eb03bb
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    unicodedata.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\unicodedata.pyd
                    • Size 695KB
                    • SHA256 3f462ee6e7743a87e5791181936539642e3761c55de3de980a125f91fe21f123
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    VCRUNTIME140.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_1456_134207090962683629\VCRUNTIME140.dll
                    • Size 117KB
                    • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Zenium.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_1456_134207090962683629\Zenium.dll
                    • Size 10.8MB
                    • SHA256 9184a8f22602703e042f4cfad4d8fcd2aa14a785d76d3d412e2bf6c7be35a2b8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _bz2.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_1456_134207090962683629\_bz2.pyd
                    • Size 83KB
                    • SHA256 55894b2b98d01f37b9a8cf4daf926d0161ff23c2fb31c56f9dbbac3a61932712
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _hashlib.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_1456_134207090962683629\_hashlib.pyd
                    • Size 63KB
                    • SHA256 78223aef72777efc93c739f5308a3fc5de28b7d10e6975b8947552a62592772b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _queue.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_1456_134207090962683629\_queue.pyd
                    • Size 34KB
                    • SHA256 73cade82ee139459fe5841e5631274fc9caf7f579418b613f278125435653539
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _socket.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_1456_134207090962683629\_socket.pyd
                    • Size 82KB
                    • SHA256 62d0493ced6ca33e2fd8141649dd9889c23b2e9afc5fdf56edb4f888c88fb823
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _wmi.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_1456_134207090962683629\_wmi.pyd
                    • Size 39KB
                    • SHA256 afad80f9e62a57814779cf3e48352b583c1a0697b11a23cc9db3f4e43f7f8664
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    cd.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_1456_134207090962683629\charset_normalizer\cd.pyd
                    • Size 10KB
                    • SHA256 9600015558d9b65ddcc950d587bc02ef6dadb6f6a0f31f2b1dac150fecf7e09f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    libffi-8.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_1456_134207090962683629\libffi-8.dll
                    • Size 38KB
                    • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    python313.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_1456_134207090962683629\python313.dll
                    • Size 5.8MB
                    • SHA256 78b1dd211c0e66a0603df48da2c9b67a915ab3258701b9285d3faa255ed8dc25
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    select.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_1456_134207090962683629\select.pyd
                    • Size 31KB
                    • SHA256 81f124b01a85882e362a42e94a13c0eff2f4ccd72d461821dc5457a789554413
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    vcruntime140_1.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_1456_134207090962683629\vcruntime140_1.dll
                    • Size 48KB
                    • SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    memory/1456-85-0x0000020518A10000-0x0000020518A41000-memory.dmp
                    Download

                    memory/3892-72-0x00000248D6440000-0x00000248D6471000-memory.dmp
                    Download

                    memory/4652-78-0x000001AC39B80000-0x000001AC39BB1000-memory.dmp
                    Download